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Abstract. Automated verification of living organism models allows us 
to gain previously unknown knowledge about underlying biological pro¬ 
cesses. In this paper, we show the benefits to use parametric time Petri 
nets in order to analyze precisely the dynamic behavior of biological os¬ 
cillatory systems. In particular, we focus on the resilience properties of 
such systems. This notion is crucial to understand the behavior of bio¬ 
logical systems (e.g. the mammalian circadian rhythm) that are reactive 
and adaptive enough to endorse major changes in their environment (e.g. 
jet-lags, day-night alternating work-time). We formalize these properties 
through parametric TCTL and demonstrate how changes of the envi¬ 
ronmental conditions can be tackled to guarantee the resilience of living 
organisms. In particular, we are able to discuss the influence of various 
perturbations, e.g. artificial jet-lag or components knock-out, with regard 
to quantitative delays. This analysis is crucial when it comes to model 
elicitation for dynamic biological systems. We demonstrate the applica¬ 
bility of this technique using a simplified model of circadian clock. 

Keywords: parametric time Petri net, resilience, biological oscillators, 
model checking 


A Logical characterization 

A.l Notations 

The sets IN and M'*' are respectively the sets of natural non-negative real num¬ 
bers. An interval I of M"*" is a N-interval iff its left endpoint belongs to N and 
its right endpoint belongs to N U {oo}. We set A = {x\x € < y for some 

y G /}, the downward closure of I and = {x\x G > y for some y G /}, 

the upward closure of I. We denote by 2i(N) the set of N-intervals of M''". 



A.2 Parametric time Petri nets with read and logical inhibitor arcs 


We consider the model-checking problem of parametric time Petri net with read 
and logical inhibitor arcs models. This class of models allows us to use paramet¬ 
ric temporal bounds for transitions. Therefore, the model-checking procedure 
addresses the model verification versus the given property together with the pa¬ 
rameter synthesis problem. Here we use models that produce only bounded nets, 
so adding the read and logical inhibition arcs does not add the expressivity to 
parametric time Petri Nets formalism [ 5 ]. A parametric time Petri net with read 
and logical inhibitor arcs (P-TPN) is a tuple JV = (P, T, A,* 

Mo,Js,Dx), where: 

— P = {pi,P2, ■ ■ ■ ,Pm} is a non-empty finite set of places, 

— T = {ti,t2 ,..., tn} is a non-empty finite set of transitions, 

— A = {Ai, A2,..., A/} is a finite set of non-negative natural parameters, 

— *(.) G (N^) is the backward incidence function, 

— (.)* S is the forward incidence function, 

— '^(.) G (N^)'^ is the read function, 

— °(.) € (N^)'^ is the inhibition function, 

— Mq G is the initial marking of the net, 

— Jg & (J"(A))'^ is the function that associates a parametric firing interval to 
each transition, 

— D\ C is a convex polyhedron that is the domain of the parameters. 

The net Af is parametrized with a set of temporal parameters A together with 
linear constraints that define the domain D\. Linear constraints are given in the 
form 7 = X]i=o ~ where coefficients ai,b G M., i G { 1 ,... , 1 } and relation 
{<, >, <,>,=}. We select the natural subset Dx C Dx from the set Dx C 
defined by constrains 7. A valuation of the parameters is a function : A 1—>■ No 
that assigns the value to each parameter, i.e. [j^(Ai),..., viAi)^ G Dx- We define 
a parametric time interval as a function Jg : Dx >—>■ T(N) that associates an 
integer interval to each parameter valuation ( 2 i(N) denotes the set of N-intervals). 

A marking M of the net is an element of N^ such that p G P the number 
of tokens is M{p). A transition t is said to be enabled by the marking M if 
[{M >• t) A (M t) A (M < °t)], and denoted by t G enabled(M). 

We define the semantics of a P-TPN Af via the semantics of TPN |A/]],y by 
assuming the certain valuation of parameters v G Dx such that lA/]]^ = (P, T, A, 
*(•)> where Vt G T,Ig{t) = Jgit){v) and 

— a transition t is Arable if it has been enabled for at least ^Ig{t) time units, 

— a transition tk is said to be newly enabled (denoted by f enabledftk, M, ti)) 
by the firing of the transition ti from the marking M if the transition is 
enabled by the new marking M = M —'ti + t* but was not by M. Formally, 


t enabledftk, M, ti) = {^tk < M ^ A (^k < M ^ A (^k > 
[{tk = ti) V (*4 > M) V (°4 > M) V (°4 < M)] . 


A 




The set of transitions newly enabled by firing the transition ti from the 
marking M is denoted by f enabled{M, ti), 

— a state of TPN is given by the pair q = {M, I) where M is a marking and 
I G (I(N))'^ is an interval function that associates a temporal interval with 
every transition enabled at M. 

The semantics of a TPN lA/”]!, can be defined as a time transition system 

= {Q, go, —t), where two kinds of transitions are possible: time transitions 
(when time elapses) and discrete transitions (when a transition of the net is 
fired), where: 

- Q = X I(N)'r, 

- go = (Mo, Is), 

— — Q X (T U N) X Q is the transition relation including a time transition 
relation and a discrete transition relation. The time transition relation is 
defined \/d gN as: 

(M,/) {M,r) iffVt, e T, 

{ (tr(ti),r{ti)^), 

^riu) = max(0,^/(ti) - d),r{ti)^ = I{ti)^ - d, 
if t G enabled{M), 

I{ti), otherwise , 

^M>Ui^ I{ti)^ > 0 


The discrete transition relation is defined \/ti G T as: 


(M,/) 


{M',r) iff < 


ti G enabled(M), 
M' = M-Hi+fi, 

^nU) = 0 , 


Vtfe G T, I'{tk) 


Is{tk) if tk et enabled{tk,M,ti) 
I(tk,) , otherwise 


A.3 Parametric TCTL 

In this subsection, we begin by recalling the definition of TPN-TCTL [ 3 ], that 
was inspired by TCTL [ 1 ] to tackle bounded time Petri nets. Then we give its 
parametric version introduced in [S]. These logics have been implemented in 
the Romeo tool [5] , which allows to analyze timed extensions of Petri nets and 
perform parametric model-checking. 

But first, let us define Generalized Mutual Exclusion Constraints, i.e. combi¬ 
nations of conjunctions and/or disjunctions of linear constraints that limit the 
weighted sum of tokens in a subset of places. 

Definition 1 (Gmec ). Let N be a P-TPN. A Gmec is inductively defined by: 

Gmec ::= lxic|:/3V'!/|(pA'0|(/J=>'0 

where Oi G Z, pi G P, txi G {<,<,=,>,>}, c G IN and Lp,il) G Gmec, the 
operators (V,A,^/ having their usual meaning. 






Definition 2 {TPN-TCTL ). The temporal logics TPN-TCTL is inductively 
defined by: 


ip := GMEC I -'(/? I (/? => V' I \ Eip Ujil) (1) 

where GMEC is a Gmec, Lp,ip & TPN-TCTL, I is an interval from N with 
integer bounds s.t. [n,m], [n,m[, ]n,m], ]n,m[, or n,m G IN. 

The operators have their classical meaning and we use the following 

aliases: true = ^false, EFicj) = 3true Ujcj), AFicf) = Atrue Ujcj), EGif = 
AGj(j) = ~^EFj—'(p. 

This logics can be parametrized the following way: 

Definition 3 {PTPN-TCTL ). The parametric temporal logics PTPN-TCTL 
is inductively defined by: 

(fi := Ftp U[ip I Ap Uiip I EFjp \ AFjp \ EGjp \ AGip \ p tp (2) 

where p and if are Gmec, I and P are parametric intervals with integer bounds 
s.t. [n,m], [n,m[, ]n,m], ]n,m[, or n,m G IN, with the restriction that 

Ir = [0, to] or Ir = [0, Oo[. 

Here, the bounded time response operator is defined as AF {p ^ AFj^if). 

B Resilience properties of biological oscillatory systems 

B.l Resilience related PTPN-TCTL query specification 

Properties A-F introduced in the main body of the paper describe a certain set of 
behaviors that is normally exposed by the circadian clock model Ncc- However 
we can study the applicability of the model using the parameters in the transition 
firing interval function. The main external stress in the framework of mammalian 
circadian clock is light (sunlight or artificial light). The distortion of the normal 
day-night cycle affects the nominal behavior which causes negative effects like 
jet-lag. Let us consider how we can model the change of light conditions in the 
framework of our model. 

Query I Does property (f[T\ = (pA (fs (fc holds when light is always off? 

It is known [7] that the circadian clock functions with a period of approximately 
24 hours in the absence of light. In order to check this property we use the 
different initial state which is also consistent with [ 1 ], namely M(Plo) = Ij 
M{Pgi) = 0 and M{Ppco) = 1- We add an observer O that prevents the light 
from changing its state, O = {po}^ M{po) = 1 and °ton = Po- The property is 
satisfied by the model Ncp with the values of parameters different from those 
defined under the normal light entrainment. 

In order to prevent the certain behavior in the system associated with tran¬ 
sitions T' C T we add observers Ot = {Pot}^ Tf(Pot) = 1 for each t G T' such 
that °t = Pot. 


Let us now enrich observers with parameters when it is possible. With that, 
we can check the limits of robustness of a certain system under the perturbed 
environmental conditions. 

Query II What is the possible duration of the period with light such that 
holds? 

In order to check this property, we add the observer that substitutes the original 
transition responsible for switching the light off by another transition t* with the 
parametric firing interval Js(i*) = [TdiTd] such that O = {po^t*}^ M(jpo) = 1, 
°toff = Po, *t* = Pli and t* = Plq. We also have fixed the values of rpy and 
Ti o and Tg = 1 to mimic the nominal behavior therefore limiting the possible 
search space for Td- This property is satisfied by the model Ncc, = 1 with 

T-dS [6,12]. 

The last property we consider addresses the perturbation of the light condi¬ 
tions by switching on the light during ’’night” (the period with = 1 that 
preserves the nominal behavior). 

Query III For how long can the light be switched on during ’’night” such that 
<([ 7 ] holds? 

In order to check this property, we add the observer Oi that inhibits the transi¬ 
tion ton and the observer O 2 that models switching the light on during ’’night”. 
We show the relevant part of the Petri in Figure (the detailed description of 
observers is omitted for the sake of readability). This property is satisfied by the 
model NcCi with Tg — r 2 > 1, r 2 -I- T3 € [0,4] , where we require ri -I- T2 -I- T3 = 12. 
Unfortunately it does not directly answer the stated question and more biologi¬ 
cally inspired properties are needed to get more precise parameter estimations. 



[12,12] [ri,Ti] 


Fig. 1. Light switch observer during ’’night”. 


B.2 Model elicitation 

We have formulated a series of properties as shown above. By checking them, 
biologists may gain new inspirations about the underlying biological processes 



as well as it can be used to make the elicitation of the model that describes 
certain biological phenomenon. Here we provide the two example for circadian 
clock model. 

Firing delay of transition tg. When introducing the model in Figure 2, we add 
only one constraint 7 = {tq > 1} so that it is not instantaneous. We check the 
property where we fix the values of oscillation parameters, namely Toy = 
18, Ti o = 6 (property A), rgy = 6 , Ti^q = 18 (property B), and tq i = 5 
(property C). However, the parameter synthesis does not give any additional 
information about the transition tg. We construct the observer from property E 
for the transition tg and check the property EF[o_oo] {M{po,tg) > O), and the 
latter does not hold. Indeed, the only possible value of the parameter = 0 is 
biologically irrelevant. It raises the question about the behaviors where transition 
tg is needed: it might be relevant only for a certain perturbation of environmental 
conditions. We modify the model by making the firing intervals of transitions off 
and on parametric, such that Js{toff) = [Toff,Toff] and Js{ton) = [tou, Ton], and 
inducing the additional condition on parameters Ton + Toff = 24. The property is 
then satisfied for Tg > 1, Ton G [7, 11] and Tg >1, Ton = 23. This shows that the 
model provided in [3] initially allows for various biologically relevant behaviors. 

Firing delay of transition ta ■ The model checking of property E shows that it 
is only satisfied with the zero firing delay Ta = 0 of the transition ta- As in 
the previous example, we may ask the question about the environmental light 
conditions that allow for the hring of transition ta with the initial firing delay 
Ta = 7 . We check the property EF^q ^o] {M{po,tg) > 0), where the observer for 
transition ta is constructed in the same fashion as in property E. It is then 
satished with Ton G {23,24}. The case Ton = 24 corresponds to property I 
where circadian clock in constant darkness is considered. We see that the set of 
admissible behaviors such that ta is eventually fired is larger than we predicted. 
It shows as well that the model in |3] has a certain redundancy that allows 
to address the change of environmental conditions. Having enough biologically 
relevant knowledge it may be possible to define the delays of all transitions in 
the system using this approach. 

This work-flow can be applied to any P-TPN model that describes gene 
regulatory network. Having enough biological knowledge that can be formalized 
in terms of PTPN-TCTL properties, such models can be refined together with 
the limits of their applicability. Model checking procedures can not address the 
pure inference problem, therefore this preliminary knowledge is needed. 

B.3 Effects of gene knock-out and artificial jet-lag 

The observers introduced above allow to study the behavior of the system after 
the gene knock-out and under the effect of artificial jet-lag. The effect of gene 
knock-out can be modeled by simply suppressing all the behaviors that allow the 
set of genes G to change its state from 0 to 1, that is by suppressing transitions 
4 and tf. The behavior of the system Ncc is then restricted only to changes 


of light state and there is no permanent oscillations of protein PC which means 
that gene knock-out leads to the system malfunction. 

Let us discover the effect of artificial jet-lag on the model, when the duration 
of the period with light is prolonged (since the period without light does not 
affect the standard behavior much). We assume that there are no perturbations 
during first 24 time units, then the light is switched on for 30 time units and 
after that the system returns to the nominal behavior. This effect can be modeled 
in a similar way to query [ij We add the observer that prevents the light from 
switching off after 24 time units and allows it again after 16 time units. In this 
way it is guaranteed that M(pli) = 1 for 30 time units without any switching. We 
show the relevant part of the Petri net with the observer in Figure Checking 
the property A shows that the system does not function normally as the time 
for PC to change the state from 0 to 1 is Top > 36. This corresponds to the fact 
that tc is the only transition that changes the state of PC from 0 to 1 and it is 
enabled only when light is switched off. It is important to notice that P-TPN 
formalism does not allow to model the recovery process of the system since it is 
ruled by local clocks only. For instance, if the delay observer 'O is added with a 
delay of 100 time units, the result of model checking the property A after this 
delay refers to the standard behavior, i.e. Top > 18. 



Fig. 2. Artificial jet-lag observer 


B.4 Resilience in PTPN-TCTL formalism 

Here we stated the number of properties that describe the standard behavior 
of the circadian clock model such as permanent oscillation and entrainment 
properties of the set of genes G. Please note that we can judge only about certain 
local time properties meaning that there is no notion of the global clock in P-TPN 
models. Due to the limited expressivity of PTPN-TCTL, we enrich the model 
with observers that are given in a fairly general fashion. We also addressed the 
limits of the model applicability by enriching the observers with parameters that 
are determined by parameter synthesis procedure. It allows us to verify resilience 
related properties such as robustness to changes in the environmental conditions. 
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